-
Notifications
You must be signed in to change notification settings - Fork 64
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Don't explode sdists before installing them #166
Conversation
This now fails with a
Off the top of my head, I'm, not sure why all of these dependencies have different versions of |
Here's what happens when we install the
So it downgrades the already installed |
Being a little more clever about sdist filtering reduced the resolution error down to two:
|
Where is this coming from? That's a really tight pin that I don't see anywhere in |
That's a really good question; I'm not 100% sure yet. Our install step for Here's the
|
This is ready for review: it doesn't fix the impossible resolution bug, but I want to get it out of the way so that we can make other (performance-minded) improvements to this part of the code. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
names = t.getnames() | ||
pkg_name = names[0] | ||
t.extractall(pkg_dir) | ||
sdist = Path(pkg_dir) / self.filename.name |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Haha that's awesome. I didn't realise you could do that.
## [1.1.0] ### Added * CLI: The `--path <PATH>` flag has been added, allowing users to limit dependency discovery to one or more paths (specified separately) when `pip-audit` is invoked in environment mode ([#148](pypa/pip-audit#148)) * CLI: The `pip-audit` CLI can now be accessed through `python -m pip_audit`. All functionality is identical to the functionality provided by the `pip-audit` entrypoint ([#173](pypa/pip-audit#173)) * CLI: The `--verbose` flag has been added, allowing users to receive more more verbose output from `pip-audit`. Supplying the `--verbose` flag overrides the `PIP_AUDIT_LOGLEVEL` environment variable and is equivalent to setting it to `debug` ([#185](pypa/pip-audit#185)) ### Changed * CLI: `pip-audit` now clears its spinner bar from the terminal upon completion, preventing visual confusion ([#174](pypa/pip-audit#174)) ### Fixed * Dependency sources: a crash caused by `platform.python_version` returning an version string that couldn't be parsed as a PEP-440 version was fixed ([#175](pypa/pip-audit#175)) * Dependency sources: a crash caused by incorrect assumptions about the structure of source distributions was fixed ([#166](pypa/pip-audit#166)) * Vulnerability sources: a performance issue on Windows caused by cache failures was fixed ([#178](pypa/pip-audit#178)) ## [1.0.1] - 2021-12-02 ### Fixed * CLI: The `--desc` flag no longer requires a following argument. If passed as a bare option, `--desc` is equivalent to `--desc on` ([#153](pypa/pip-audit#153)) * Dependency resolution: The PyPI-based dependency resolver no longer throws an uncaught exception on package resolution errors; instead, the package is marked as skipped and an appropriate warning or fatal error (in `--strict` mode) is produced ([#162](pypa/pip-audit#162)) * CLI: When providing the `--cache-dir` flag, the command to read the pip cache directory is no longer executed. Previously this was always executed and could result into failure when the command fails. In CI environments, the default `~/.cache` directory is typically not writable by the build user and this meant that the `python -m pip cache dir` would fail before this fix, even if the `--cache-dir` flag was provided. ([#161](pypa/pip-audit#161)) ## [1.0.0] - 2021-12-01 ### Added * This is the first stable release of `pip-audit`! The CLI is considered stable from this point on, and all changes will comply with [Semantic Versioning](https://semver.org/) ## [0.0.9] - 2021-12-01 ### Added * CLI: Skipped dependencies are now listed in the output of `pip-audit`, for supporting output formats ([#145](pypa/pip-audit#145)) * CLI: `pip-audit` now supports a "strict" mode (enabled with `-S` or `--strict`) that fails if the audit if any individual dependency cannot be resolved or audited. The default behavior is still to skip any individual dependency errors ([#146](pypa/pip-audit#146))
Fixes #159.